SYSTEM AND METHODS TO PERFORM ROW LEVEL FIELD MASKING LEVERAGING ATTRIBUTE BASED ACCESS CONTROL IN A MULTI TENANT ENVIRONMENT
A computer implemented masking manager provides a method for access controls. The method includes receiving a request for an object in a database, retrieving the object from the database, applying masking rules to a field of the object to determine whether the requestor has access to the field, determining a replacement value for the field based on requestor access to the field, and returning the object to the requestor with the replacement value in the field of the object.
1 . A method for implementing access controls by a masking manager, the method comprising:
receiving a request for an object in a database;
retrieving the object from the database;
applying masking rules to a field of the object to determine whether the requestor has access to the field;
determining a replacement value for the field based on requestor access to the field; and
returning the object to the requestor with the replacement value in the field of the object.
2 . The method of claim 1 , further comprising:
determining whether the requestor is associated with any masking rules.
3 . The method of claim 1 , wherein the replacement value is a null or masking value.
4 . The method of claim 1 , further comprising:
notifying a platform logic of replacing a value of the field.
5 . The method of claim 1 , further comprising:
determining a classification of the field where the classification indicates a type of masking rule to apply to the field.
6 . The method of claim 1 , further comprising:
receiving a set of classifications for fields of an object type in the database; and
promulgating the set of classification to the fields of the object type in the database.
7 . A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform operations of a method for implementing access controls by a masking manager, the operations comprising:
receiving a request for an object in a database;
retrieving the object from the database;
applying masking rules to a field of the object to determine whether the requestor has access to the field;
determining a replacement value for the field based on requestor access to the field; and
returning the object to the requestor with the replacement value in the field of the object.
8 . The non-transitory machine-readable storage medium of claim 7 , the instructions further comprising:
determining whether the requestor is associated with any masking rules.
9 . The non-transitory machine-readable storage medium of claim 7 , wherein the replacement value is a null or masking value.
10 . The non-transitory machine-readable storage medium of claim 7 , the instructions further comprising:
notifying a platform logic of replacing a value of the field.
11 . The non-transitory machine-readable storage medium of claim 7 , the instructions further comprising:
determining a classification of the field where the classification indicates a type of masking rule to apply to the field.
12 . The non-transitory machine-readable storage medium of claim 7 , the instructions further comprising:
receiving a set of classifications for fields of an object type in the database; and
promulgating the set of classification to the fields of the object type in the database.
13 . A computing device to implement a method for access controls by a masking manager, the computing device comprising:
a non-transitory machine-readable medium having stored therein a masking manager; and
a processor coupled to the non-transitory machine-readable medium, the processor to execute the masking manager, the masking manager to receive a request for an object in a database, retrieve the object from the database, apply masking rules to a field of the object to determine whether the requestor has access to the field, determine a replacement value for the field based on requestor access to the field, and return the object to the requestor with the replacement value in the field of the object.
14 . The computing device of claim 13 , wherein the masking manager is further to determine whether the requestor is associated with any masking rules.
15 . The computing device of claim 13 , wherein the replacement value is a null or masking value.
16 . The computing device of claim 13 , wherein the masking manager is further to notify a platform logic of replacing a value of the field.
17 . The computing device of claim 13 , wherein the masking manager is further to determine a classification of the field where the classification indicates a type of masking rule to apply to the field.
18 . The computing device of claim 13 , wherein the masking manager is further to receive a set of classifications for fields of an object type in the database, and promulgate the set of classification to the fields of the object type in the database.